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Quantum data hiding in the presence of noise 

Cosmo Lupo, Mark M. Wilde, and Seth Lloyd 


Abstract —When classical or quantum information is broadcast 
to separate receivers, there exist codes that encrypt the encoded 
data such that the receivers cannot recover it when performing 
local operations and classical communication, but they can 
decode reliably if they bring their systems together and perform a 
collective measurement. This phenomenon is known as quantum 
data hiding and hitherto has been studied under the assumption 
that noise does not affect the encoded systems. With the aim of 
applying the quantum data hiding effect in practical scenarios, 
here we define the data-hiding capacity for hiding classical 
information using a quantum channel. Using this notion, we 
establish a regularized upper bound on the data hiding capacity 
of any quantum broadcast channel, and we prove that coherent- 
state encodings have a strong limitation on their data hiding 
rates. We then prove a lower bound on the data hiding capacity 
of channels that map the maximally mixed state to the maximally 
mixed state (we call these channels “mictodiactlc”—they can be 
seen as a generalization of unital channels when the input and 
output spaces are not necessarily isomorphic) and argue how to 
extend this bound to generic channels and to more than two 
receivers. 


I. Introduction 

One of the primary goals of theoretical quantum information 
science is to identify significant separations between the 
classical and quantum theories of information. Many grand 
successes in this spirit have already been achieved; Bell 
inequalities IT], unconditionally secure communication El, 
quantum teleportation a, super-dense coding |4l, communi¬ 
cation complexity a, quantum data locking 0, and so on. 

Another such notable example is the quantum data hiding 
effect E), 0, 13, m. Quantum data hiding is a commu¬ 
nication protocol that allows for the encoding of classical or 
quantum information into a two-party system such that the 
information can be decoded if the systems are located in 
the same physical laboratory, whereas the information cannot 
be decoded if the systems are located in spatially separated 
laboratories, even if the laboratories are allowed to exchange 
classical messages. Such a task is impossible in the classical 
world, simply because the exchange of a classical message 
from one laboratory to the other allows for sending the entire 
classical system, such that it is subsequently located in the 
same physical laboratory and can thus be decoded. Arguing 
from the uncertainty principle of quantum mechanics, quantum 
data hiding allows for the encoding of information such that 
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it is indistinguishable by local measurements and classical 
communication and one instead requires a global measurement 
to distinguish the states (i.e., information can be “hidden” in 
this way). 

The original proposal for quantum data hiding was an 
impressive observation Q, the idea being to hide information 
in Bell states such that it can be recovered by a joint quantum 
operation but not by local operations and classical communi¬ 
cation. The scheme from El has a low rate of hiding, and a 
quantum optical implementation was suggested. However, the 
proposal rested on there not being any loss or noise in the sys¬ 
tem and was thus impractical in several regards. Nevertheless, 
this striking phenomenon prompted further research, which 
eventually culminated in the high-rate schemes of mi . These 
schemes relied upon the use of collective random unitary 
operations to hide both classical and quantum data, invoking 
mathematical techniques such as the concentration of measure. 
The newly proposed schemes still required no loss or noise 
in the encoded systems, which exclude their application in 
practice. These schemes were later extended to the case of 
hiding information from multiple parties IfT^ . 

Even though this fascinating protocol has been discussed for 
some years now in the literature and a variety of applications 
are now known, no one (as far as we are aware) has yet to 
consider the most pertinent practical question: Is quantum data 
hiding possible in the presence of noise and loss, and if so, 
what is its performance? Here, we address this fundamental 
question using the language of quantum Shannon theory and 
recently developed techniques that have established quantum 
data locking protocols in the presence of noise ini, na, 
(na, HE), El (see also El for another advance in the same 
direction). The channels of primary interest to us are those 
which have the property of mapping the maximally mixed 
state in the input space into the maximally mixed state in the 
output space. We called these channels mictodiactic (literally, 
Greek for “mixtures passing through”) as they preserve the 
maximally mixed state. Mictodiactic channels coincide with 
unital channels if the input and output space have the same 
dimension. We focus on these channels mainly because they 
are relatively simple to analyze. 

The main development of this paper begins with a formal 
definition of the data hiding capacity of a quantum broadcast 
channel. From there, we establish a regularized upper bound 
on the data hiding capacity of any broadcast channel, and we 
then show that coherent-state protocols cannot offer a high 
rate of data hiding (this is perhaps to be expected, given 
that coherent states are “pseudo-classical” and in light of our 
prior work in which we showed that they do not offer high 
rates for quantum data locking El). We next establish a 
lower bound on the data hiding capacity of a mictodiactic 
quantum broadcast channel and argue that this scheme can be 
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extended to generic channels and to a multipartite scenario. 
The scheme involves random coding arguments, and we invoke 
concentration of measure bounds in order to establish security 
of the scheme. 

II. Preliminaries 

Here we recall some basic facts before beginning the main 
development. A quantum state is represented by a density 
operator, which is a positive semi-definite operator acting on 
a Hilbert space T-L and with trace equal to one. A multipartite 
quantum state acts on a tensor product of Hilbert spaces. A 
classical-quantum state pxB has the following form: 

PXB = ^Px(a:)|a;)(a::|x ® Pbi (1) 

X 

where px is a probability distribution, {|x);^} is an orthonor¬ 
mal basis, and {p%} is a set of quantum states. A quantum 
channel is modeled as a completely positive, trace-preserving 
linear map, taking operators acting on one Hilbert space to 
operators acting on another one. A quantum channel is unital 
if it preserves the identity operator (note that the input and 
output space of such a channel must have the same dimension). 
A quantum measurement is a special kind of quantum channel 
which accepts a quantum input system and outputs a classical 
system. That is, it can be described as follows: 

Af(p)=^Tr{AMl2/)(2/l, ( 2 ) 

y 

where > 0 for all y, {|?/)} is some known 

orthonormal basis. The collection {A^} is called a positive 
operator-valued measure (POVM). A quantum instrument is a 
quantum channel that accepts a quantum input and outputs a 
quantum system and a classical system. 

A quantum broadcast channel is defined as a quantum 
channel that accepts one input quantum system A and has 
two output quantum systems B and C M- Formally, it is 
a completely positive trace preserving linear map from the 
space of operators that act on the Hilbert space for system A 
to the space of operators acting on the tensor-product Hilbert 
space for systems B and C. An important example of such 
a channel is one that mixes an input mode with two vacuum 
states at two beamsplitters such that the two receivers obtain 
two of the beamsplitter outputs while the environment obtains 
the other mode Il20l , 11211 . One could incorporate noise effects 
in addition to loss by mixing with thermal states instead of 
vacuum states. 

The class of local operations and classical communication 
(LOCC) consists of compositions of the following operations: 

1) Alice performs a quantum instrument, which has both a 
quantum and classical output. She forwards the classical 
output to Bob, who then performs a quantum channel 
conditioned on the classical data received. 

2) The situation is reversed, with Bob performing the initial 
instrument, who forwards the classical data to Alice, 
who then performs a quantum channel conditioned on 
the classical data. 

An LOCC measurement is a measurement channel that can 
be implemented by means of local operations and classical 


communication. Every LOCC channel can be written in the 
following form (as a separability preserving channel): 

Cab{pab) = ^ (Cl 0 D^b) Pab (Cl 0 , ( 3 ) 

X 

such that (Cl 0 (Cl 0 D|) = Iab- However, not 
every channel of the form above is an LOCC channel ll22l . 

The trace norm of an operator A is defined as ||AH = 
Tr[vAL4], and it induces the trace distance ||p —crjl as a 
measure of distinguishability between two quantum states p 
and a. The von Neumann entropy of a state p on system A is 
equal to S'(A)p = S{p) = — Tr[plogp]. The quantum mutual 
information of a bipartite state pab is defined as 

I{A-B)p = S{A)p + S{B)p-S{AB)p. ( 4 ) 

The LOCC accessible information of a classical-quantum- 
quantum state pmbc is as follows: 

/acc,LOCc(M;BC)p= max /(M;M)^, (5) 

where the mutual information on the RHS is with respect to 
the following classical-classical state: 

^MM = ^BC^M^PAIBc), ( 6 ) 

and is an LOCC measurement channel. 

HI. Quantum data hiding capacity 

In a quantum data-hiding protocol, the sender Alice com¬ 
municates classical or quantum information to two spatially 
separated receivers Bob and Charlie via a quantum broadcast 
channel Ma^bc- The protocol satisfies the “correctness prop¬ 
erty” if Bob and Charlie can decode reliably when allowed 
to apply a joint quantum measurement (i.e., if they are 
located in the same laboratory). On the other hand, the “data- 
hiding/security property” is that the transmitted information 
cannot be accessed by Bob and Charlie when they are re¬ 
stricted to performing local operations and classical communi¬ 
cation (i.e., if they are in different laboratories connected by a 
classical communication channel). When Alice sends classical 
information, we call this a bit-hiding protocol and define it as 
follows: 

Definition 1 (Bit-hiding protocol): An {n,M^S,e) bit¬ 
hiding protocol for a quantum broadcast channel fifA^BC 
consists of a collection of input states {p[x)}x=i,...,M^ ^ 

decoding measurement satisfying the following properties: 

• (Correctness) It is possible to decode with high average 
success probability, that is, 

^ ^ Tr [A^B.c-Aff-BciPm > 1 - , (7) 

X 

where {A^„p„} is the POVM associated to the decoding 
measurement. 

• (Security) For all LOCC measurements Ad logo on the 

bipartite system B^C^, there exists a state such 

that 

Jp X! ||■^LOCc(■A/■®!^Bc(p(2^)) “ < £ • 


( 8 ) 
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Remark 1: Due to the convexity of the trace norm, it is 
sufficient to prove the security property against rank-one 
LOCC measurements. 

We can now define the bit-hiding capacity of a quantum 
broadcast channel Ma^bc'- 

Definition 2 (Bit-hiding capacity): A bit-hiding rate R is 
achievable for a quantum broadcast channel Ma^bc if for 
all i5, e, C G (0)1) sufficiently large n, there exists an 
(n, M, <5, e) bit-hiding protocol such that 1- log M > R — 
The bit-hiding capacity /t(AA) of Af is equal to the supremum 
of all achievable bit-hiding rates. 

In this paper we focus on bit-hiding protocols. One can 
also define qubit-hiding protocols, aimed at hiding quantum 
information (see ini). Similarly, one could define a notion 
of qubit-hiding capacity of a quantum channel. Additionally, 
these definitions immediately generalize to the case of a 
channel with one sender and an arbitrary number of receivers. 


IV. Regularized upper bound on quantum data 

HIDING CAPACITY 


We begin by establishing a regularized upper bound on the 
bit-hiding capacity of any channel: 

Theorem 1: The bit-hiding capacity K{J\f) of a quantum 
channel Af is bounded from above as follows: 

K{Af) < lim (9) 

n^oo Tl 

where 

^ max [I{X-BC)p - hcc.LOCciX; BC)p ], 

{px{x),px} 

PXBC = ''^Pxix)\x){x\x ® AfA^Bc{Px)- (10) 

X 

Proof: This upper bound follows by using the definition 
of a bit-hiding protocol and a few well known facts. Let 
us consider an (n, M, 6, e) bit hiding protocol. By a simple 
reduction (see Appendix 13, the correctness criterion in (|7]l 
translates to the following criterion: 

— ^MM'Wi < S, (11) 

where ^mm' is a maximally correlated state, defined as 

^MM' = ^'^\x){x\m ^\x){x\m', ( 12 ) 


and ujmm' is defined from the probability distribution on the 
LHS of 0 as 




^ M 

x^x' 


Then 


— Tr 




B^C^J'^A^BC 


(p(x)) \x)(x\m '^\x’)(x'\m’- 

(13) 


logM = IiM-,M% (14) 

<I{M;MX + f{n,S) (15) 

</(M;B"C")^+/(n,b). (16) 

The first inequality is an application of the Alicki-Fannes 

continuity of entropy inequality ll^ , with f{n, S) a func¬ 
tion such that lim^^o liiiin->oo ^/(it-) = 0. The second 


inequality is a consequence of the Holevo bound Il24l . where 
we have denoted the state after the channel (but before the 
decoding measurement) again by to. As a consequence of the 
security criterion in ([8]) and the Alicki-Fannes inequality, we 
can conclude that 

/acc.LOCc(M; < gin, e), (17) 

with g{n, e) a function such that lime_ 5 .o lim„^oo -gin, £) = 
0. So this gives 

logM < /(M; B"C") - /acc,LOCc(M; B^C^) 

+ f{n,S)-i-gin,e). (18) 

We finally optimize over all possible channel inputs, divide by 
n, take the limit as n —oo and then as e, (5 —>■ 0 to establish 
the statement of the theorem. ■ 


V. Upper bound eor coherent-state data-hiding 

PROTOCOLS 

Here we show that data-hiding schemes making use of 
coherent-state encodings are highly limited in terms of the 
rate at which they can hide information. We assume that 
the mean input photon number is less than Ns G (0,c») 
and Alice is connected to Bob and Charlie by a bosonic 
broadcast channel EOI, in which Alice has access to one 
input port of a beamsplitter, the vacuum is injected into the 
other input port, and Bob and Charlie have access to the 
outputs of the beamsplitter. The main idea behind the bound 
that we prove here is that the classical capacity of the pure- 
loss bosonic channel is limited from above by giNs) ll25ll . 
where gix) = (a; -I-1) log 2 (a: -f 1) — a;log 2 x. At the same 
time, if Bob and Charlie perform heterodyne detection on their 
outputs and coordinate their results, the rate at which they can 
decode information is equal to log 2 (1 + Ns). Our proof of the 
following theorem makes this intuition rigorous. Notably, this 
bound is the same as that found in lfT3l for the strong locking 
capacity when using coherent-state encodings. 

Theorem 2: The quantum data-hiding capacity of a bosonic 
broadcast channel when restricting to coherent-state encodings 
with mean photon number Ns is bounded from above by 
giNs) - log2(l + Ns) < log2(e) 1.45. 

Proof: Consider a quantum data-hiding scheme consisting 
of coherent-state codewords: {|q;"'(x, fc))}^ where ja") = 
|cti)® |a 2 )® • • |q!„) and such that the mean photon number 

of the scheme is less than Ns € (0,oo). Then the quantum 
codeword transmitted for message x is as follows: 

pix) = ^'Y^\a:^ix,k))ia'^ix,k)\. (19) 

k 

So the classical-quantum state corresponding to the transmitted 
state is as follows: 


^MKB’^C^ = 

1 


MK 


|a;)(a;|M C) \k){k\K 0 |07Q;"(x, k)) (y^a”(x, k)\^ 


x,k 


v'l - ■qa^ix,k)'^ - T]a^ix,k) 


C-n 


, ( 20 ) 









4 


where ly^a”) is a shorthand for \^ai) 0 \^a 2 ) 0 • • • 0 
\V^an)- 

In order to obtain our upper bound, we suppose that Bob 
performs heterodyne detection, forwards the results to Charlie, 
who also performs heterodyne detection and coordinates the 
results to decode. Now begin from the upper bound in ( fTST i: 

/(M; - /acc,LOCc(M; 

< I{M- - /het,Lo(M; (21) 

= I{MK- - I{K; B'^C^lM)^ 

- [/het,Lo(MiC; - /het,Lo(if; B^C^\MU (22) 

= I{MK; - /he,Lo(Mi^; 

- [I{K-B^C^\M)^ - /het,Lo(if;-B"C"|M)a.] (23) 

< /(MX; - /het,Lo(MX; (24) 

< max \I{Y-B^C^)r - /het,Lo(r; (25) 

PY(y) 

< n max [/(F; BC), - /het,Lo(>^; BC),]. (26) 

PY{y) 

The first inequality follows by picking the LOCC measure¬ 
ment to be the classically coordinated heterodyne detection 
mentioned above. The first equality follows from the chain 
rule for conditional mutual information, and the second equal¬ 
ity is a rewriting. The second inequality follows because 
/(X;B"C"|M)a, - /het.Lo(if;S"C'"|M)^ > 0, which is 
a consequence of data processing: the classical heterodyne 
detection measurement outcomes are from measuring systems 
B"C". The second-to-last inequality follows by optimizing 
over all input distributions and the information quantities are 
evaluated with respect to a state of the following form: 




'^PY{y)\y){y\Y 0 \^/pa'^{y)) ( 07 a”( 2 /)lB. 
y 




C" 


(27) 


The last inequality follows by realizing that the difference 
between the mutual informations can be understood as be¬ 
ing equal to the private information of a quantum wiretap 
channel in which the state is prepared for the receiver while 
the heterodyned version of this state (a classical variable) 
is prepared for the eavesdropper. Such a quantum wiretap 
channel has pure product input states (they are coherent states) 
and it is degraded. Thus, we can apply Theorem 35 from im 
to conclude that this private information is subadditive. The 
information quantities in the last line are with respect to a 
state of the following form: 


CTYBC 


'^PY{y)\y){y\Y 0 \Vvoi{y)) {y/va{y)\g 
y 


v'l - miy)) (v/i - miy) 


(28) 


Now by a development nearly identical to that given in 
Eqs. (34)-(42) of |[I3, we can conclude that a circularly 
symmetric, Gaussian mixture of coherent states with variance 
Ns optimizes the quantity in (l26l l. For such a distribution, the 
quantity I{Y\BC)„ evaluates to 


(29) 


We now evaluate the quantity /het,Lo(^; 77C')cr. Consider that 
the output for Bob is a random variable ^J^)a + Zb, where a 
is a zero-mean Gaussian random variable (RV) with variance 
Ns and 2:5 is a zero-mean Gaussian RV with variance 1. The 
output for Charlie is a RV + zc, where a is the 

same Gaussian RV as above and zc is a zero-mean Gaussian 
RV with variance 1 (note that a, zb, and zc are independent 
RVs). The covariance matrix for the real part of these RVs is 
as follows: 

■ piVs/2 + 1/2 ^y{\-ri)Ns/2 1 

Vr 7 (l - ri)Nsl2 (1 - p) iV5/2 + I/2J ’ 

with determinant equal to 

J(A's + l). (31) 

The determinant of the covariance matrix of the real parts of 
the RVs ZB and zc is equal to 1/4. By modeling the real and 
imaginary components as two independent parallel channels 
and plugging into the Shannon formula for the capacity of a 
Gaussian channel, we find that 

/het,Lo(l^; BC)„ = \og{Ns + 1). (32) 

So we can finally conclude the upper bound on the data hiding 
capacity of coherent-state schemes. ■ 

VI. Lower bound on quantum data hiding capacity 

Here we prove a lower bound for the bit-hiding capacity 
of mictodiactic quantum broadcast channels. We consider a 
channel Ma^bc from an input quantum system of dimensions 
dim A = (Ia^o the output systems with dimensions dim B = 
dB and dimC = dc- A mictodiactic channel is defined from 
the following property: 

AfA^BcilA/dA) = lBc/{dBdc), (33) 

where I a and Ibc denote the identity operators acting on the 
input and output spaces, respectively. 

Theorem 3: The bit-hiding capacity K{Af) of a mictodiactic 
broadcast channel Ma^bc^ with dim A = dimB = dB 
and dim 67 = dc is bounded from below as follows: 

(A/) = xW) - log d+ - log 7 . (34) 


where 

X{M) = s(^Jd^ - j d^p S{Nm (35) 

is the Holevo information of the channel computed for a uni¬ 
form ensemble of input states {dij) denotes the uniform mea¬ 
sure on the sphere of unit vectors), and d+ = maxjdB, dc}- 
The parameter 7 is given by 

0^2 a2 

where || • ||oo is the c»-norm and Psym is the projector onto 
the symmetric subspace. 

A proof is given in the next section. 


I{Y-BC)^ = g{Ns). 
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As an example consider the d-dimensional depolarizing 
channel, with d = (Ia = dsdc'- 


N{X) =pX+{\-p) Tr(A:)//d. 


(37) 


Let us first compute the Holevo information for the uni¬ 
form distribution of input states. A straightforward calculation 
yields 


x{M) = logd+ {p + 


1-p 


d 

+ {d- 1) 


log 

1-p 


1-p 


log 


1-p 


Then consider the density matrix 
is mapped by {Af 0 Af) into 


^ sym o 

Tr(Psym) “ (i(d+l) 


(38) 
which 


{Af(8)Af) 


P. 


sym 


Tr(Psym) 


= P' 


2 Psym 


Tr(Psym) 




, (39) 


where we have used the fact that the partial trace of ^ 

is the maximally mixed state I/d. We hence have 


— Tr(Psyi„) 

d{d + 1) 
“ 2 
d + 1 


(A/"® A/") 


Ps 


sym 


+ 


Tr ( Psym ) 
1 — 


d{d + 1) 

d -I- 1' 


2d 


1 - 


2d 


Finally, from 


putting dsdc = d we obtain 


7 = 1 + 


2d 


- 1 


(40) 

(41) 

(42) 

(43) 


^d -I- 1 

For the case of unital channels, which are contrac¬ 
tive with respect to the Schatten norms ll26ll . we have 
IKA/"® A/')(Psym)|loo — ll-^sym|loo = 1, from which we obtain 
the following looser bound; 

(AT) > x(A/') - log d+ - log . (44) 


A. Proof of Theorem Q 

We now provide a proof for Theorem [3 We generate a 
bit-hiding code for n uses of the quantum broadcast channel 
Na -^BC, by employing the well known method of random 
coding. For x = 1,...,M, pick a collection of M pure 
quantum states at random, each having the following form: 

n 

li’ix)) =(^\i’j{x)). (45) 

j=i 

These random unit vectors are each generated by sampling 
\'tjjj{x)) independently from the uniform distribution over the 
unit sphere in A simple way of doing so is to single out a 
fiducial unit vector |0) € and pick a unitary 14j at random 
according to the Haar measure on SU{d), in order to generate 
= V^j |0). Let 


n 



j=i 


We then pick Kn qudit unitaries Ukj i i d. from the Haar 
measure on SU{d). The inputs to the channel have the 
following form: 

1 ^ 
k^l 

where 

n 

Uk = (^Ukj. ( 48 ) 

i=i 

We introduce the notation V = {Vi,... ,Vm) to denote 
the M-tuple of n-local qudit unitaries and the notation U = 
(f/i,..., Uk) to denote the AT-tuple of n-local qudit unitaries, 
and we further define Ti\j as follows: 

1 ^ 

= (49) 

fe=i 

We also define the random variables V and U, taking values 
on the set of M-tuples V = (14,..., Fm) and AT-tuples 
U = (C/i,..., Uk), respectively, where each qudit unitary is 
statistically independent and uniformly distributed according 
to the distribution induced by the Haar measure on SU{d). 

Given the input codewords in Wt\ . the state at the output 
of n channel uses is as follows: 


Ar®"(p(x))=Ar8"(Pu(^(a:))) (50) 

= Ar®"(Pu(44|0)(0|14)). (51) 


We split the proof into two parts: first we prove the 
correctness property and then the security property. 

1) Correctness: The proof of the correctness property has 
a rather standard form, but we provide it for completeness. Let 
) denote the do-weakly typical projection for the tensor- 
power state [A/'(7r)]®", where tt denotes the maximally mixed 
state and do > 0 (see, e.g., lIZTil for a definition and properties). 
This projector has the following properties which hold for all 
£0 G (0,1) and sufficiently large n: 

> 1 - £0, (52) 

< 2-[s(AA(^))-5o]n;(^Jo^. ( 53 ) 

Let a spectral decomposition of the state Af^'^iUk 'fix) U\) 
be as follows; 


Af^-iUkfix)Ul) = Y,p{y-\k,x)\yl,) (y,%| , (54) 

yn. 


where the eigenvalues p{jj'^\k,x) form a product distribution 
because the state is tensor product. Let denote the di- 

weak conditionally typical projection corresponding to the 
state Af'^'^iUk'fix)Ul), defined as the projection onto the 
following subspace: 



1 

n 


logp(y"-|fc,x) 




(55) 


where di > 0 and S'* = J dip S(A/’(^)) (see, e.g., llTTl for 
more details). These projectors have the following property, 
which holds for all £i G (0,1) and sufficiently large n: 


{Tr (n;(;fW®'‘(C/fe^(x)C/t)) } > 1 - £i. (56) 


(46) 
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(In fact, both eg and ei can be taken to be exponentially 
decreasing in n, following from an application of the Chernoff 
bound.) So this means that we can build a reliable decoding 
measurement from the set {11^ a,} of projectors. Another 
property of the conditionally typical projector is the following 
bound on the size of each projector: 

Tr(n”^) < (57) 


We then consider a “square-root” decoding measurement 
defined by the following POVM elements: 

- 1/2 / ^ - 1/2 

— I ^ ^ a 

\k',x' 

jn,(5o jTn,(5i-prn,(5o 

^W(7r)- 



(58) 

(59) 


The average probability of an error when decoding both x and 
k is as follows: 

Perr = 1 “ ^ Tr (Afe^ajA/"®” (l/'fc (x))), (60) 

k,x 


where we have introduced the shorthand tjjkix) = Uktp{x)Ul. 
Recall the Hayashi-Nagoaka operator inequality ll^ 

7 - (p + p{p + g)-^/" < 2 (7 - p) + 4g, (6i) 

which holds for 0 < P < 7 and g > 0. Picking 

P = Tk,x, Q= Y. ( 62 ) 

(k' ,x')^{k,x) 

we can apply this to dbOl l to bound it from above as 

k,x 

+ A^E E Tr(rfc,,,,A7®"(V^fe(x))). (63) 

k,x (k' ,x')^{k,x) 

Now taking an expectation over a random choice of both V 
and 17, by (l52l i and (fSbl) and the gentle measurement lemma 
am, (Eoi (see also El), it follows that 


lEv,u [Tr([7-rfe.,]A7®"(V:fe(x)))] < 2^ + ei. (64) 


By picking 

— log M -f — log K = S — S', — 2^0 — 2(5i, (72) 

n n 

we can ensure that 

Ev,u[Perr] <2[2y^ + ei]+4.2-'^('5“+^i). (73) 

Eventually, we will derandomize the random bit-hiding code 
in order to conclude the existence of one with this error 
probability bound. 

2) Security: To simplify the notation we set d = dsdc- 
To prove the security of the protocol against an LOCC 
measurement we show that 

^ E ll-^LOCC (AffUBciPix)) - 7®"/rf")L < "2 , 

X 

(74) 

for an arbitrarily small £2 € (0,1) and for all LOCC mea¬ 
surements. In fact, what we show is an even stronger bound 
by proving that the protocol is secure against all separable 
measurements Algep- 

For a given codeword '0(a:) and a separable measurement 
Adsep (with POVM elements {P^ 0 C^}), we define the con¬ 
ditional random variable F|17 from the following distribution: 

PY\u{y) = Tr[(P^ 0 A7®"(7^u(V'(^)))] • (75) 

We then consider the mutual information of the random 
variables Y and 17, given that codeword ijjix) was transmitted: 

7(y; 77) = H{Y) - H{Y\U) . (76) 

We first consider the case of separable projective mea¬ 
surements Adpro-sep, which have separable POVM elements 
P^0C'^ = where (j)^g and (j)Q are rank-one projectors 

acting on Bob and Charlie’s systems, respectively. By applying 
concentration inequalities to the conditional probability distri¬ 
bution PY\\j{y)^ we show that (see Appendix iBl for details) 
for K > K{n,dB,dc,S 2 ) 

sup 7(y;77) = 0(^2logd”), (77) 

X ,..Ad( pro-sep 

where 82 € (0,1) and 


Recalling that each unitary is independent of another, for 
{k',x') ^ {k,x), we find that 


Ev.w [Tr(rfc,,,,A7®"(r/:fc(x)))] 

= Tr(Ev,u [Tt',x'] Ev,w [Af^^iMx ))]) 

(65) 

= Tr(Ev,u [Ar(^)]®”) 

(66) 

= Ev.u [AA(7r)]®” 

(67) 

< 2-['S(V(^))-<5o] Tr(n{)bbnX^(5^)) 

(68) 

< 2“['5(V(’r))-^o] Tr(^{)b^) 

(69) 

^ 2“['S(V(7'’))-<5o]2"'['5*+'5i] 

(70) 


107” 

K{n, dB,dc,S 2 )= SdirS 2 ^ log ^ , (78) 

02 

with 7+ = max{7 b, 7c}- 
The Pinsker inequality (see, e.g., El) states that 

Iby.u-pyPulli = / rfUE |py|u(2/)-Py(2/)| 

y 

< A/21n27(r;77). (79) 

Using dTTl i and the Pinsker inequality we then obtain that for 
all M codewords 'tpix) and Adpro-sep 


Putting everything together, we find that 


1 7U \\Mpro-sep (A^(7^u(b(^))) - 7®”/7")||^ 


Ev.w [^^err ] < 2 [ 2 ^/^ -f £ 1 ] 


= /dUE |7'y|u(y) -PYiy)\ < 0{y/S2logd^). (80) 

V 
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Taking an average over all messages and exchanging this 
average with the expectation over unitaries, we find that 

'Ev.u ll-^p—p imnumx))) - 

< 0 ( 7(52 logd"). (81) 

Then, in Appendix |C] we show how this result can be 
extended to the case of generic separable measurements by 
applying some techniques developed in 
Finally, by choosing 

- log AT = log d+ + log 7 + A ^ , (82) 

n n 

where A > 0 is a positive constant, the condition K > 

K{n, ds, dc, 62 ) is satisfied and implies that the LHS of dSTl i 

decreases sub-exponentially in n. 

To conclude the proof we combine the conditions ( l72b and 
( |82] | to obtain that as long as the rate satisfies the following 
condition 

— log M = S' (A/’( 7 r)) — S, — logd+ 
n 

- log 7 - - 2(5o - 2(5i, (83) 

n 

then and dSTl i are satisfied. This in turn implies that there 
exist choices of the unitaries {Ui,..., Uk) and (Ti, • ■ •, Vm) 
such that these conditions are satisfied and thus there exists 
an (n, M, <5, e) bit-hiding code such that <5 and e are vanishing 
with increasing n. The asymptotic rate of the generated 
sequence of codes is then as given in the statement of the 
theorem. 

B. Multipartite Generalization 

The result of Theorem^is readily generalized to a multipar¬ 
tite setting. Suppose for instance that Alice sends information 
from a system of dimension through a mictodiactic channel 
Af to i receivers, Bi,..., B^, with Hilbert space dimensions 
dj = dim Bj, and we require security against LOCC measure¬ 
ments. In this case we would obtain the following achievable 
bit-hiding rate: 


statements. We notice that the mictodiactic condition is used 
only to obtain ( 111111 , that is, 

Eu{Xk) = j^. ( 86 ) 

where 

Xk = Tr (fAf'^^{Uki>[x)Ul)) . (87) 

The vector cfA corresponds to one of the POVM elements of 
a decoding measurement. 

The first unproven statement is that, for n large, (j)^ belongs 
to the typical subspace associated to {Eu{Uk'4’{x)U\)) = 
A/’®"( 7 r®") = AT^tta)®'^, where tta = lA/dA denotes 
the maximally mixed state on system A. Let then 

denote the projector onto the typical subspace. Putting (fA = 
we have 

Eu{x,) = Tr 

The equipartition property of the typical subspace (see e.g. 
liTTl l yields 


< : (89) 

with S = S{Af{TTA))- This in turn implies 


2 -„(s+ 5 ) ^ 2-"(S+'5) Tr ^ ^uiXk) 

< Tr . (90) 

These bounds generalize the condition (II 1 lb . where 2‘® re¬ 
places dsdc and plays the role of the effective dimension of 
the output system. 

Similarly, consider the second moment, see dl 151) . 


Eu{Xl)=Tr 





Tr(Psym) 




(91) 


The second unproven statement is that the measurement 
vectors arerf the form 

where ) is the typical projector associated to the 

state Af®'^ ^ tTp " ) • equipartition property implies 


x{Af) - log dp - log 7 , 


with dp = maxj dj and 


7 = 


dA^dA + 1 ) 




(84) 


(85) 


VII. Discussion 

The main contribution of this paper is to provide a formal 
definition of the data hiding capacity of a quantum channel 
and upper and lower bounds on this operational quantity. Our 
work thus initiates the study of “noisy data hiding,” and we 
now suggest several directions for future study. 

It could be possible to generalize Theorem |3] such that it 
applies to generic, non-mictodiactic, channels. Now we show 
how this generalization is obtained assuming two unproven 


Tr 




n,(5 



^ sym 

TrP 

-Li-t svrr 


071 


n 


'AA®2(Psym) 


< ^ (92) 


where S 2 = S[Af®^. 

In conclusion, by modifying (ESI), it could be possible 
to extend Theorem |3] to non-mictodiactic (and non-unital) 
channels with 7 redefined as 


( EuiXl) E / 27 ^A 
\Eu{XkYj -\ 2 -^AS+s)j 


_ 22S—S 2+35 ^ 

(93) 


Notice that this extension of Theorem [3 also improves the 
bound for mictodiactic channels. We leave a full development 
of the above observations for future work. 


















There are several ways in which the lower bound of Theo¬ 
rem 13 could be further improved. Let us recall that a map TZ 
is said to be an approximately randomizing map with respect 
to a given norm || • ||*, if for all states ip, 

miP)-TT\U<e, (94) 

where tt is the maximally mixed state. There exists a close 
relation between data-hiding protocols and approximately ran¬ 
domizing maps. For instance, the data-hiding protocol of im 
was obtained by modifying a related approximately random¬ 
izing map with respect to the operator norm || • ||oo- Several 
constructions of approximately randomizing maps with respect 
to the operator norm and the trace norm were discussed in 1^ . 
041 . OSl . 0^ . It could indeed be possible that these maps 
can be used to develop quantum data hiding protocols robust 
to noise and achieving higher rates. If this is true, it might be 
possible to achieve a bit-hiding rate of 

x(AA)-logd+. (95) 
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Appendix A 

Let M be a random variable. Let pmm' denote the distri¬ 
bution in which M' is a copy of M, so that 

PMM'{m,m') = pM{m)6m,m'- (96) 

Let qmm' denote the distribution that results from sending 
random variable M' through a channel qM'\M{Tn'\m), so that 

qMM'{m,m') = PM{,rn)qM'\M(,rn'\m). (97) 

Then the probability that M' ^ M under qMM' is equal to 
the normalized trace distance between pmm' and qMM' '■ 

Pr{M' ^ M} = - Wpmm' — quM'Wi ■ (98) 

q 2. 

Consider that 

Vy{M"^M}= V qMM'{rn,m') (99) 

m'^m 

= X! PM{'m)qM'\Mim'\m). (100) 

m'^m 


Consider also that 

WPMM' — QMM' 111 

= \PM{m)S m^m' - PM{m)qM'\M{m'\m)\ ( 101 ) 

m,m' 

= X! Pm(to) - 7m'|m(to'|to)| (102) 

m,m' 

= X] PM(m)gM'|M(w'|m) 

m^m' 

+ '^PMim) [1 - gM'|M(m|m)] (103) 

m 

= 2 X PM[m)qM'\Mim'\rn). (104) 

m^m' 

So the equality in ( l98l l follows from (|99])- (I1001 | and (llOll i- 

(fTM . 

Appendix B 

Concentration inequalities 

In a crucial passage in the proof of Theorem [3 we have 
applied the bound 

liY'M) =0(6 log d^), (105) 

holding for any separable measurement. Here and in Appendix 
ICl we prove that this bound holds true provided 

lOr/" 

K > K{n, dB, dc, S) = log , (106) 

with 7 as in ( l36l l. 

We do so by first showing that (11051) holds for separable pro¬ 
jective measurements Alpro-sep, which have separable POVM 
elements (jr^g (g) (jy^, where (p^g and are rank-one projectors 
acting on Bob and Charlie’s systems, respectively. This is 
done in Proposition [3 where we apply techniques analogous 
to those applied in da, m- In Appendix |C] we show how 
this result can be extended to the case of generic separable 
measurements by applying some techniques developed in 1^ . 

We will make use of two concentration inequalities. The 
first one is Maurer’s tail bound llJTl : 

Theorem 4: Let {Xk}k=i,...,K be K i.i.d. non-negative 
real-valued random variables, with ~ X and finite first 
and second moments: E[A], E[X^] < oo. Then, for any r > 0 
we have that 

P,|^gx,<E[.Y|-r}<exp(-^). (107) 

The second one is the Chernoff bound ll^ : 

Theorem 5: Let {Xk]k=i,....K be K i.i.d. random vari¬ 
ables, Xk ~ X, with 0 < X < 1 and E[A] = p. Then, 
for any r > 0 such that (1 -|- t)p < 1 we have that 

+ (108) 

For given states ip(x) and 4>y = 4>l 0 we apply these 
bounds to the quantity 


Afc = Tr 


(109) 







9 


This quantity is a random variable if the unitary Uk is chosen 
randomly. Taking the average over the random unitaries Uk 
we obtain 

T^n 

Eu{Uk^Pix)Ul) = — , 


( 110 ) 


which for mictodiactic channels implies 

1 


Eu(Xfc) = 




( 111 ) 


We also consider the second moment 

Eu(Xl) = [ dC/feTr 




< 8)2 


= Tr 


3 = 1 


R 


sym ? 


( 112 ) 


(113) 


For any two-qudit pure state p we have 

J dA{dA + 1 ) 

where Psym is the projector onto the symmetric subspace (see, ment Adpro-sep we consider the quantity 
e.g., i^ ). We then obtain 

2 


Finally, we consider the function p{-) = —{■) log (•). Using 
the inequality \p{r) — ? 7 (s)| < p{\r — s|) (which holds for 
|r — s| < 1/2) we obtain 

\viPY\\j{y)) - v{PY\ij{y)) \ < v{‘2e). (122) 


From now on, to make notation lighter, we put d := dsdc- 
We are now ready to prove the following; 

Proposition 1: For any <5 G (0,1) and K > 
K{n,dB,dc,S), 

sup /(U;W) = 0((51ogd"), (123) 

<2),A^pro-sep 

where the sup is over separable projective measurements 

M pro-sep- 

First of all, we notice that for a projective measurement 
with associated POVM elements {(j)^ = 0 /'c}y=i,...,d" 

the mutual information (fThl) reads 

I{Y;U) = logd^ - H{Y\U), (124) 

where we have also used the condition (111II) . 

For a given vector '/’(a;) and separable projective measure- 


^uiXl) = 


dA{dA + 1)_ 


< 


dA{dA + 1)_ 


(114) 

’||A/'®^(^sym)||^ (115) 


(where we have used the fact that the expectation value of an 
operator on a vector is upper bounded by the oo-norm), from 
which it follows 




< 




VEu(Afe)V - dA{dA + l)"^' 

(116) 

We will also make use of the notion of a net of unit vectors 
CD. Let us recall that an e-net is a finite set of unit vectors 
Ae = {</} in a P-dimensional Hilbert space such that for any 
unit vector S there exists 6 G for which 


||</- (/111 < £• 


(117) 


As discussed in CD there exist e-nets with less than (5/e)^^ 
elements. Let us consider a pair of vectors (ps, pc and the 
corresponding vectors pB, Pc in the net such that 

||(/b - </s||i, ll/'c - (/c||i < e ■ ( 118 ) 

We consider the quantity defined in ( l75l i: 

PY\u{y) = , (119) 

and 

PY\viy) = ^i[(Pb ® </c) ■^'*"(^u('(/(a;)))]. (120) 

We have 


H{Y)u =-'^PY\u{y)logpY\-u{y) (125) 

y 

^'^viPYiuiy)]- (126) 

y 

For a given y, we want to bound the probability that 
H{X)\J < (1 ~ <5)logd”. In order to do that we bound the 
probability that 77[py| u(y)] < P[^]- Notice that ? 7 [a;] is a 
concave function and the equation p[x\ = has two 

roots: X- = and a;+ = 1 - p[^] -f 0 (? 7 [ 1 ^]), where 
for d" large enough a:+ > 1 — 2p[l^]. Therefore we have 

Prw ^v[PY\u{y)] < ^^^p^logd" 

< Piu {pYluiy) < a:-} -f Pru {pY\u{y) > a^-r} 

r 1 (5' 

< PiulpYiviy) < 

+ Pm{PY\u{y)>i-S'} , (127) 

where S' = 2p[l^]. 

For given x and y, we now apply the Maurer tail bound 
(Theorem di to the random variables 

Xk := Tr (^Pl 0 PlAf»''{UkP{x)Ul)) , (128) 

whose first and second moments are given by (II 1 II) and (II121) 
and obey the inequality in (II161 ). We remark that 

^■^Xfc=py|u(2/). (129) 


K 


Hence, applying (11071 ) with r = bE[2f] = b/d", we obtain 
Pi'u |ff|u(2/) < 


l-S^ f K5‘^E[XY\ 

< exp-) (130) 


2E[A2 





\pY\\j{y) - PY\\j{y) < 2e. 

(121) 

27- j 


( 131 ) 
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Similarly we apply the Chernoff inequality, Theorem|5] and where 0 = Q[H{Y)u — {1 — 6) log d"' + cr'r]{Sd ")] de- 
obtain notes the Heaviside step function, which finally yields 


Pm {PY\u{y) > 1 - 5'} < exp 


Kd^{l-S' -1/d^y 


4 In 2 


< exp — 


A"d"(l/2)^ 
41n2 


, (132) 


where the last inequality holds for sufficiently small 5' and 
large d". We then have 

r 1 (5 

Pm \ v{pY\u{y)) < —^ logd’^ 


< exp — 


< 2 exp — 


K5^ 
27 " 
K6^ 


exp 


Kd^il/2f 

41n2 


2Y- 


(133) 

(134) 


where the last inequality holds for any d" > 81n27“"(5^. 

This is true for given x and vectors (j)^Q. To account for 
all possible codewords "tpix) and measurement vectors cj)^g, 
(pQ, we introduce a ((52“^d“")-net for Bob’s system and a 
((52“^d“”)-net for Charlie’s one, containing in total no more 
than elements. Applying the union bound 

on the net’s vectors and on the M codewords we obtain 


Pr 


inf^ ri{pY\\j{v)) < 



< 2M 

< 2M 

< exp 





exp 


K6^ 


2Y' 


4d!i 


exp 


- 4d!;: log 


KS‘^\ 
27 " ) 
lOd" 


log(2M) 


-■P, 


(135) 

(136) 

(137) 

(138) 


where d+ = max{dB,dc}- From this, we can extend the 
infimum over all unit vectors by paying a small penalty given 
by (II 22 I 1 . In this way we obtain 

Prl inf v{pY\u{y)) < logd" - 77((5d“”) I <p. 

(139) 

The probability of such a bad event can be made arbitrarily 
small provided (we are assuming log (2M) <C 4d" log 1^^) 

lOd" 

a: » 87 ’"d" d-2 log . (140) 

o 

Under this condition we then have that, up to a small proba¬ 
bility p, for all separable projective measurements A4pro-sep, 

H{Y)u > (1 - d) log d” - d"p(dd-”). (141) 

This implies 

HiY\U) = J dVHiY)u (142) 

> J dUid(y)u0 (143) 

> [(1 - 6) log d" - d"77(dd-")] (1 - p), (144) 


sup I{Y- U)<5 log d" + d”r 7 (dd“") 

, A4pro-sep 

+ [(1 - 5) log d" - d"? 7 (dd-")] p 

= 0(dlogd"). (145) 


Appendix C 

From projective measurements to generic 

SEPARABLE MEASUREMENTS 


In this appendix we discuss how Proposition [T] can be 
extended to include generic separable measurements via the 
notion of separable quasi-measurements. In order to do that 
we apply a simple modification of Lemma 6.2 in 
The notion of quasi-measurement was defined in 
Definition 3 (Quasi-Measurement H32\l ): We call (s,/) 
quasi-measurement an incomplete measurement on a D- 
dimensional system such that the associated POVM elements 
are of the form where cp^, for y = l,...,s, are 

rank-one projectors and '^y^i^-(p^ ^ f I- We denote as 
C{s,f) the set of (s,/)-separable quasi-measurements. 

Lemma 6.2 in proves that quasi-measurements are 
almost as informative as generic measurements, that is, given 
a bipartite quantum state pus we have 


sup||7W {puB - Pu<Si pb)\\i 

M 

< sup \\M' {puB - Pu Pb)\\i 

-h 4i:)2g-s(,,-l)V(D(21n2)) ^ 

where the sup on left hand side is over generic measurements 
JyIb^y on the B system, and that on the right hand side is 
over quasi-measurements 

To apply this result to our setting, we first define the notion 
of separable quasi-measurements by adapting Definition [3 to 
the LOCC setting: 

Definition 4: [Separable quasi-measurement] We say that 
an incomplete measurement on a x Z^c'-dimensional bi¬ 
partite system is an (s, /)-separable quasi-measurement if the 
associated POVM elements have the form ^ 

where (p^g, cp^, for y = l,...,s, are rank-one projectors, 
such that (p'^g (p'^ < fisc- We denote as 

Csep{s,f) the set of (s,/)-separable quasi-measurements. 

We notice that the proof in Appendix |Bj which considers 
separable projective measurements, also applies to the case of 
separable quasi-measurements. This implies that, by consider¬ 
ing the set of (s, /)-separable quasi-measurements, a modified 
version of Proposition [1] will be obtained, i.e., 

sup I{Y;Vl) = 0{dlogs). (147) 

X.MGCsepisJ) 

To move from separable quasi-measurements to generic sep¬ 
arable measurements we apply a straightforward modification 
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of Lemma 6.2 in ll^ in the LOCC setting, that is, 

sup \\M {puBC - Pu ® PBc)\\i 

A^sep 

< sup \\M' {puBC - Pu ® PBc)\\i 

M' sep^Csep{s,f) 

+ , (148) 

where the sup on the left hand side is over separable measure¬ 
ments right is over separable 

quasi-measurements 

In conclusion, to extend Proposition [T] to generic separable 
measurements we proceed as follows. First recall that (see Eqs. 
(|79] | and dSOl) ) given a separable measurement Afsep, in our 
setting we have 

ll-Adsep {pUBC - PU ® PBc)\\i = 

y’dU||7W,ep(A^(7eu(r/'(x)))-/®7d")||^ . (149) 

Then consider that Proposition [T] together with (|79] |. states 
that 


sup \\Mpro-sep{PUBC — PU ® PBc)\\i 

M pro —sep 

< 0{-s/5\og^), (150) 

where the sup is over projective separable measurements. As 
noticed above. Proposition [T] is straightforwardly extended 
from projective separable measurements to separable quasi¬ 
measurements, yielding 


sup \\M {puBC - Pu® PBc)\\i < 0(A/(51ogs) . 
M&Ceep{s,f) 


(151) 


Finally, using (1148b with Db = Dq = d^, we obtain 


sup \\M {puBC - Pu ® PBc)\\i 

A^sep 

< -f 4(rfgrf^)2ng-.(^-l)V(dSdS(21n2)) ^ 

(152) 

Putting, for example, s = and / = 1/2, yields 
sup \\M {puBC - Pu ® Pbc)\\i 

A^sep 

^_ / d'^ \ 

< 0(\/(51ogd2") + 4d2ngj(.p ( ^ (153) 

This result can then be used to extend the security to the case 
of generic separable measurements by paying a small penalty 
not larger than exp (—g^pj)' 
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